Privacy Policy of inteliq.pl

Version 1.1 dated 5 May 2026 (replaces version of 4 June 2025).

This is the English translation of the Polish privacy policy. In case of any discrepancy between the language versions, the Polish version prevails as the binding text.

This Policy sets out the rules for processing personal data of persons using the website operated at inteliq.pl (hereinafter: the „Website"), candidates participating in recruitment processes conducted by Inteliq Group sp. z o.o., clients using the Controller's services, and other persons whose data may be processed in connection with the conducted activity. The Policy has been prepared in fulfilment of the information obligation referred to in Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: „GDPR" or the „Regulation"). Matters not regulated in this Policy are governed by the GDPR and by the Polish Personal Data Protection Act of 10 May 2018.

Table of Contents

1. Data Controller

The controller of personal data is Inteliq Group spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) with its registered seat in Warsaw at ul. Dembego 10/181, 02‑796 Warsaw, registered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw under KRS number 0000969100, NIP 9512540135, REGON 522014999 (hereinafter: the „Controller").

The Controller's operational office is located in Warsaw at ul. Marszałkowska 89, 00‑693 Warsaw.

Correspondence to the Controller in matters covered by this Policy is accepted at: [email protected] (general matters) and [email protected] (data protection matters).

2. Data Protection Officer

The Controller has designated a Data Protection Officer (DPO) on the basis of Article 37(1)(c) GDPR, given that the Controller's core activities consist of large‑scale processing of special categories of personal data within the meaning of Article 9(1) GDPR (data which may appear in candidates' application documents). The DPO may be contacted in all matters relating to the processing of personal data and the exercise of rights under the GDPR. Contact: [email protected].

3. Categories of personal data processed

The scope of data depends on the role in which a person uses the Website or interacts with the Controller.

For Candidates (persons submitting a CV via the Website's form, taking part in recruitment processes conducted directly or under executive search engagements), the following data are processed in particular: name and surname, e‑mail address, telephone number, location, data contained in the submitted CV (employment history, education, competencies), information on financial expectations and preferred form of cooperation, willingness to work remotely or relocate, as well as links to publicly available professional profiles (where provided), notes made by the Controller during interviews and results of competency tests.

For Clients (entrepreneurs sending enquiries to the Controller or using recruitment, advisory, employer branding services), the following data are processed: company data (name, tax identification number, registered address) and the data of the representative or person authorised to maintain contact (name, surname, business e‑mail address, telephone number, position), as well as the content of business correspondence and documentation exchanged in the course of cooperation.

For Users browsing the Website, processing covers diagnostic data, in particular IP address, session identifier and browser information, as well as, subject to consent, data collected via Google Analytics 4 (client identifier, browsing behaviour); details of cookies are governed by the separate Cookies Policy.

For event participants (conferences, training, webinars organised by the Controller), the following data are processed: name and surname, e‑mail address, organisation name and technical data related to participation in the event.

Special categories of data (Article 9 GDPR)

The Controller does not request that Candidates provide special categories of data, i.e. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health or sexual orientation. Including such information in application documents is neither required nor expected. If such data nevertheless appear in a CV or other document submitted by a Candidate, the Controller deletes them without undue delay, unless the Candidate has expressly consented to their processing for recruitment purposes (Article 9(2)(a) GDPR). Such consent remains freely revocable.

4. Sources of data

The Controller processes personal data obtained:

1. directly from the data subjects — through Website forms (contact form, CV submission form), e‑mail correspondence, during phone calls and in‑person meetings;
2. from publicly available professional sources (including profiles on LinkedIn, GitHub) — to the extent necessary to conduct executive‑search recruitment processes, on the basis of the Controller's and the engaging client's legitimate interest (Article 6(1)(f) GDPR), with due regard to the balancing test;
3. from the Controller's clients — within the scope arising from the contract for the provision of recruitment services (e.g. data of contact persons on the client's side, information on vacancies).

Whenever data are obtained from a source other than the data subject, the Controller fulfils the information obligation under Article 14 GDPR without undue delay, no later than within one month of obtaining the data.

5. Purposes and legal bases of processing

The Controller remains ready to demonstrate compliance with the conditions of processing in accordance with the accountability principle expressed in Article 5(2) GDPR.

6. Recipients of data

Personal data may be entrusted to processors acting on behalf of the Controller, in particular:

1. cloud infrastructure and content delivery network providers, i.e. Cloudflare, Inc. (protection of the Website, traffic optimisation) and Amazon Web Services EMEA SARL (eu‑central‑1 region, Frankfurt — storage of application files);
2. traffic measurement service provider, i.e. Google LLC in respect of Google Analytics 4 — only after the User's consent to analytical cookies; the Controller applies IP anonymisation;
3. transactional e‑mail provider, i.e. Amazon Simple Email Service, in respect of system notifications;
4. the accounting firm serving the Controller and legal advisors, in respect of the fulfilment of legal obligations and handling of claims.

Candidate data are additionally shared with the Controller's Clients (employers) for whom recruitment processes are conducted; sharing takes place only to the extent necessary for the recruitment process and in a manner agreed with the Candidate.

The Controller does not use advertising pixels such as Meta Pixel, LinkedIn Insight Tag or other programmatic advertising tools on the Website.

State authorities, including courts and law‑enforcement agencies, receive data only to the extent required by law.

With each processor acting on behalf of the Controller, contracts compliant with the requirements of Article 28 GDPR are concluded.

7. Transfers of data outside the European Economic Area

Some of the providers referred to in Section 6 are based in third countries. Transfers of data to such countries take place under the Standard Contractual Clauses approved by the European Commission (Article 46(2)(c) GDPR) and, in respect of entities participating in the EU–US Data Privacy Framework, also on the basis of the adequacy decision. In particular:

1. Cloudflare, Inc. (San Francisco, USA) — Standard Contractual Clauses; the entity participates in the EU–US Data Privacy Framework;
2. Google LLC (Mountain View, USA) — Standard Contractual Clauses; the entity participates in the EU–US Data Privacy Framework; within Google Analytics 4 we apply a configuration that minimises the scope of data transferred outside the EEA.

Upon the request of a data subject, the Controller provides a copy of the safeguards applied.

8. Profiling and automated decision‑making

The Controller does not take decisions in respect of data subjects based solely on automated processing, including profiling, in a way that produces legal effects concerning them or significantly affects them within the meaning of Article 22(1) GDPR. Decisions on inviting a Candidate to a further stage of recruitment and on their employment remain in each case decisions of natural persons on the side of the Client or the Controller's consultant.

In executive‑search recruitment processes, the Controller may use tools that assist the identification of candidates (e.g. keyword search in publicly available professional profiles); the result of such a search constitutes only support for the consultant and does not replace a substantive assessment of a candidacy.

9. Rights of data subjects

To the extent provided by the GDPR, a data subject is entitled to:

1. the right of access to data and to obtain a copy thereof (Article 15);
2. the right to rectification of inaccurate data or completion of incomplete data (Article 16);
3. the right to erasure of data, the so‑called „right to be forgotten" (Article 17), with the exceptions provided for in Article 17(3);
4. the right to restriction of processing (Article 18);
5. the right to data portability in a structured, commonly used format (Article 20);
6. the right to object to processing based on legitimate interest (Article 21);
7. the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;
8. the right not to be subject to a decision based solely on automated processing, including profiling (Article 22).

The above rights are exercised upon request directed to [email protected] or by post to the Controller's registered address. A response is provided within one month of receiving the request, subject to the possibility of extending this period by a further two months in cases referred to in Article 12(3) GDPR.

10. Complaint to the supervisory authority

Without prejudice to the rights set out in Section 9, a data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (Polish DPA, ul. Stawki 2, 00‑193 Warsaw, uodo.gov.pl) if they consider that the processing of their data infringes the data protection legislation.

11. Security of processing

With regard to data security, the Controller has implemented technical and organisational measures appropriate to the risk referred to in Article 32 GDPR, in particular: encryption of connections using the current TLS protocol, encryption of application files at rest, role‑based access control, regular creation and testing of backup copies, and limitation of the number of requests directed to public forms. These measures are periodically verified and adjusted to the changing risk.

The Controller applies a strong‑password policy, session‑time restrictions and multi‑factor authentication for accounts with elevated privileges.

12. Personal data breaches

In the event of a personal data breach, the Controller acts in accordance with Articles 33 and 34 GDPR. Breaches likely to result in a risk to the rights or freedoms of natural persons are notified to the President of the Personal Data Protection Office no later than 72 hours after their detection. If a breach is likely to result in a high risk to the rights or freedoms of natural persons, the Controller also notifies the data subjects in a manner enabling immediate remedial action. The Controller maintains an internal breach register.

13. Cookies

The rules for the use of cookies and similar technologies are described in a separate document: Cookies Policy. In particular, the Cookies Policy describes the use of Google Analytics 4 and the consent mechanism (Google Consent Mode v2) introduced on the Website on 5 May 2026.

14. Children's data

The Website is not directed at persons under 16 years of age. The Controller does not knowingly process personal data of children. If it is discovered that data of a child have been provided without the consent of a legal representative, the Controller deletes them without undue delay.

15. Amendments to the Policy

The Policy may be amended, in particular due to changes in legislation, the scope of services provided or the tools used. The Controller informs data subjects of any material amendment to the Policy at least 14 days in advance, by e‑mail (with respect to persons maintaining an active relationship with the Controller) or by a notice displayed on the Website. The current version of the Policy remains continuously available at https://inteliq.pl/en/privacy-policy.html.

Inteliq Group sp. z o.o., ul. Dembego 10/181, 02‑796 Warsaw, KRS 0000969100, NIP 9512540135, REGON 522014999.